Six months after a hacker breached the Malta Gaming Authority, the first major story from the stolen files points to Ta’ Xbiex, a web of Maltese companies, and an arrest in Frankfurt.A Malta-based iGaming group has been linked to Platincasino, the online casino at the centre of one of Germany’s largest illegal gambling investigations. The link comes from a joint investigation by German journalist Lilith Wittmann, German public broadcaster NDR, Norway’s NRK, Sweden’s SVT and Dutch outlet Follow the Money, published under the name #casinosecrets.The reporting relies partly on documents taken from the Malta Gaming Authority’s own systems earlier this year. It estimates that around €250 million in German gambling tax went unpaid between 2023 and 2025.The raidOn Tuesday 8 September, more than 100 officers searched eleven properties, mainly in Frankfurt and the Rhine-Main region, and arrested a main suspect on a warrant, hessenschau.de reported, citing Frankfurt prosecutors. The story was also carried by tagesschau.de and t-online.Prosecutors say the arrested man and four others are suspected of offering online gambling in Germany on a commercial and organised basis, without a German licence, since at least July 2021. They put player stakes at around €5.86 billion between July 2021 and the end of 2023.Prosecutors also allege that gambling taxes were not paid, or not paid in full, and put the alleged tax loss for 2024 alone at around €77.6 million. An asset freeze of around €82 million was enforced, several high-value cars were seized and various bank accounts were frozen, according to Osthessen News and Radio Frankfurt.The operation followed more than three years of covert investigation. It involved Frankfurt’s tax investigation office, North Rhine-Westphalia’s financial crime agency and Frankfurt police, GlücksWirtschaft reported.Prosecutors have not named any of the suspects. On 17 September, Germany’s gambling regulator, the GGL, confirmed in a statement that the investigation concerns Platincasino.Wittmann reports that the man arrested is Thomas Kalman, a Frankfurt entrepreneur she identifies as Platincasino’s owner. She says a neighbour confirmed that police searched his Frankfurt apartment on the day of the raid and took away his Lamborghini. Through his lawyer, Kalman has called the allegations baseless, according to Wittmann.The hack that started itIn March, the MGA announced that one of its systems had been breached. Days later, Wittmann, a Berlin-based security researcher and member of the Chaos Computer Club, claimed responsibility. She said the data had been shared with media partners and authorities, MaltaToday reported, and that she planned to expose what she called “organised crime enablement schemes” linked to Malta.The MGA condemned the breach and said her allegations were unsubstantiated, NEXT.io reported. Wittmann said she could face up to ten years in prison under Maltese law, and warned that any action from Maltese authorities would trigger the release of her entire archive, according to iGaming Capital.This week’s #casinosecrets publications are the first major results. The project says it extracted almost two terabytes of documents from the Curaçao and Malta gambling regulators and from company registers in Malta, Cyprus and Gibraltar.From Malta to FrankfurtAccording to Wittmann, Platincasino was licensed in Malta from 2017 through Red Rhino Ltd, which held MGA licence MGA/CL1/1364/2017. The public company register showed only a trustee firm as shareholder. However, Wittmann reports that documents filed with the MGA list Kalman as Red Rhino’s sole ultimate beneficial owner.Germany opened a licensed online gambling market in July 2021. Wittmann reports that Kalman’s companies applied for a German licence but did not receive one.In September 2023, the GGL fined Red Rhino €50,000 because German players could still gamble on Platincasino.com, iGaming Business reported. German outlet casino-gesetze.de reported that Red Rhino’s MGA licence at the time covered platincasino.com, platincasino.de, casinofive.com and luckycircus.com.The MultipleThis is where the Malta angle sharpens. The Multiple Group presents itself as an iGaming services company offering white-label casinos, casino management, customer support, marketing and affiliate services. Business database Tracxn lists it as founded in 2014 and headquartered in Ta’ Xbiex. Its LinkedIn page gives a St Julian’s address.Wittmann points to three links between The Multiple and Platincasino:Platincasino’s live chat support can only be accessed through logins from The Multiple Group.A Facebook page tagged as “Red Rhino Group” in a 2022 post now leads to The Multiple’s page, which she says means the page was renamed.Kalman appears in videos of The Multiple’s staff parties in 2024 and spring 2026.Wittmann also reports that The Multiple is currently advertising for German-speaking casino support staff.The 2023 saleIn 2023, Platincasino’s brand, domains and player database were sold to Latiform B.V., a company in Curaçao, for €6 million, according to Latiform’s accounts as reported by Wittmann. For comparison, she reports that Red Rhino paid €5.6 million in German gambling tax in October 2022 alone.A database migration plan filed with the MGA in August 2023 lists the staff involved in the handover, according to Wittmann. They include staff of The Multiple in Malta and Jake Stagno Navarra, who Wittmann reports holds stakes in several companies alongside Kalman. Stagno Navarra is not accused of any wrongdoing and has not been identified as one of the five suspects.Wittmann says she found no evidence that German gambling tax was paid after Platincasino moved to Curaçao.The Maltese companies that boomedWittmann maps a network of more than 26 companies under Gibor Ventures Holding Ltd, a Maltese holding company held through a trustee, which she links to Kalman. Its interests range from a music label and property to a Malta-based mixed martial arts league.According to company accounts cited by Wittmann, two of those companies grew sharply as Platincasino moved to Curaçao. YMDM Services Ltd went from €54,000 in revenue to nearly €34 million. PNH Services Ltd went from zero to €6.7 million. Both booked the income as affiliate marketing and casino support.In Wittmann’s view, The Multiple is less a single company than a brand for several companies in Kalman’s network, and the 2023 sale changed Platincasino’s official owner more than the people operating it.The €250 million questionGermany taxes online slots at 5.3% of every euro staked. Wittmann estimates the unpaid tax for 2023 to 2025 at around €250 million. Her calculation assumes 85% of Platincasino’s players are German and infers stakes from reported player losses. Prosecutors’ own figure is €77.6 million for 2024 alone.What the MGA now facesThe story raises questions for Malta’s regulator. What did it know about Red Rhino’s ownership? How did it respond to Germany’s 2023 fine? And what happened to Red Rhino’s licence after the casino moved to Curaçao?The #casinosecrets team says it plans to release the full document database, which means more Maltese names may soon be public.All allegations are unproven. The German investigation is ongoing, and everyone is presumed innocent unless proven guilty. •